CVE-2026-103271

Summary

A content API vulnerability in Ghost CMS versions 4.0.0 through 6.62.9 allows unauthenticated users to access restricted posts by directly querying the API endpoint. This bypasses the normal authentication and authorization controls that should prevent public access to gated content.

Exploitability

The vulnerability is easily exploitable with no prerequisites as attackers can directly query the content API endpoint without any authentication, making it a straightforward path to access restricted content.

Blast radius

The impact could be significant for blogs or sites using Ghost CMS with sensitive gated content, potentially exposing confidential posts, member-only articles, or proprietary information to the public.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Ghost version 6.63.0 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.